What is the Travel Rule?
The Travel Rule is a financial regulation requiring originator and beneficiary information to “travel” with a transfer above a defined threshold. Originally a US Bank Secrecy Act rule from 1996, it was extended to Virtual Asset Service Providers (VASPs) via FATF Recommendation 16 (2019) and is now national law in most jurisdictions including Turkey.
What information must travel
- Originator name, address, account/wallet ID
- Originator identification number (national ID, passport)
- Beneficiary name and account/wallet ID
- Transaction amount and timestamp
Threshold
FATF recommended threshold is USD/EUR 1,000: many jurisdictions adopt this; some adopt lower (Singapore: SGD 1,500; Hong Kong: HKD 8,000 ≈ USD 1,000). Turkey’s implementation under MASAK is set out in MASAK’s Regulation on Measures as amended in the Official Gazette of 25 December 2024, which requires originator information to be included and verified for crypto-asset transfers at or above a threshold. Presidential Decision No. 11845 (Official Gazette 7 October 2026, No. 33393) raised that threshold from TRY 15,000 to TRY 30,000 with effect from 7 October 2026; see MASAK obligations for fintechs.
Implementation challenges
- Unhosted wallets: No counterparty VASP to receive the data: most jurisdictions require risk-based controls; the EU under TFR (Regulation (EU) 2023/1113, applicable since 30 December 2024) requires identity verification even for self-hosted
- Cross-VASP interoperability: Different VASPs use different protocols (TRP, TRUST, Sygna Bridge, OpenVASP, Notabene, VerifyVASP); industry working on convergence
- PII vs blockchain transparency: Privacy concerns about sharing identity data
Major Travel Rule protocols
- TRP (Travel Rule Protocol): Industry collaboration
- TRUST: Coinbase-led, US-focused
- Sygna Bridge: Used by some Asian VASPs
- Notabene: Most-adopted commercial solution
- OpenVASP: Open-source standard
Turkish CASP obligations
Under the 2024 Turkish Crypto-Asset Service Provider regulation and MASAK Law 5549, Turkish CASPs must implement Travel Rule for transfers exceeding the threshold. Failure to do so triggers MASAK fines and possible suspension of CASP license. The data sharing also requires KVKK lawful basis: MASAK obligation typically suffices but the privacy notice must disclose this transfer.
Practical implications
If you operate a Turkish CASP, integrate a Travel Rule solution (Notabene or similar) from day one. Budget for: vendor subscription ($30k-$100k/year), legal counsel for protocol-specific terms (TRP membership agreement, etc.), and KVKK-compliant privacy notice updates. See the KVKK Tracker for related Authority guidance on cross-border data flows.
Sources. Law No. 6698 on the Protection of Personal Data (KVKK), Law No. 5549 on the Prevention of Laundering Proceeds of Crime and FATF.